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DETAILED ACTION 



1 . This action is in response to the amendment filed October 30, 2006. 



2. Claims 1, 12-14, 24, and 34 have been amended. 



3.' Claims 1-37 have been examined and are pending with this action. 



Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

4. Claims 1-10, 12, 14-21, 24-32, 34, and 36-37 are rejected under 35 U.S.C. 

103(a) as being unpatentable over Tajalli et al. (US 5,361,359 A) in view of Noguchi et 

al. (US 5,812,981 A). 

INDEPENDENT: 

As per claim 1, Tajalli teaches an apparatus comprising: 

an application program comprising one or more components (see col.1, lines 52- 
54 & 65-68; and col. 6, lines 5-8: "operating system kernel and of any selected operating 
system programs, application programs..."), 
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means for selecting a component to be audited from the one or more 
components (see col. 15, lines 3-7: "collects and makes available to the administrator 
126 information about the activities of application program 514"), 

means for selecting one or more selected operations on the component to be 
audited (see col. 15, lines 15-col.16, line 9: "user activity auditing, tracks operating 
system requests made by ordinary users 126 and application programs 514... login 
attempts, file accesses and execution of programs"; "System activity information 
includes... statistics on the number of processes running..."), and 

means for creating an audit trail for the application program (see col.7, lines 1 -3: 
"generates audit logs from the information"), wherein a business component comprises 
one of a table or record comprising information associated with an entity (see col.1 , 
lines 36-41 : "For example, a business might want to protect inventory records from 
unauthorized modifications"). 

Tajalli does not explicitly teach of a business component of an application 
program. 

Noguchi teaches of a business component of an application program (see Fig. 1 
and col.4, lines 25-40). 

It would have been obvious to a person of ordinary skill in the art at the time the 
invention was made to modify the system of Tajalli in view of Noguchi to implement 
business component of an application program. One would be motivated to do so 
because Tajalli teaches that his system is generally related to reliably auditing computer 
usage in many organizations (see col.1, lines 16-20 & 24-27). 
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As per claim 14, Tajalli teaches a system comprising: 
a processor (see Fig.1, #112); 

a memory coupled to the processor (see Fig. 1 , #1 1 0, #1 1 8 & #1 1 9) and 
configured to store a first set of instructions, executable by the processor (see col. 9, 
lines 28-30), configured to provide a component (see col.1, lines 52-54 & 65-68; and 
col.6, lines 5-8: "operating system kernel and of any selected operating system 
programs, application programs...") comprising one or more fields (see col.1, line 37: 
"inventory record"), 

a second set of instructions, executable by the processor, configured to allow 
selection of a selected field of the one or more fields and one or more selected 
operations to be audited on the selected fields (see col. 15, lines 15-col.16, line 9: "user 
activity auditing, tracks operating system requests made by ordinary users 126 and 
application programs 514... login attempts, file accesses and execution of programs"; 
"System activity information includes... statistics on the number of processes 
running..."), 

a third set of instructions, executable by the processor, configured to detect when 
the selected operations are performed on the selected fields (see col. 15, lines 3-7: 
"collects and makes available"), and 

a fourth set of instructions, executable by the processor, to generate an audit 
transaction record regarding the selected field when the selected operations are 
detected (see col. 7, lines 1-3: "generates audit logs from the information"). 
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Tajalli does not explicitly teach of providing a user interface for selection. 

Noguchi teaches of a user interface for selection (see col.6, lines 52-59). 

It would have been obvious to a person of ordinary skill in the art at the time the 
invention was made to modify the system of Tajalli in view of Noguchi to implement a 
user interface for selection. One would be motivated to do so because Tajalli teaches 
that the administrator specifies the auditing configuration data, which is used by the 
system to collect audit information (see col.6, lines 67-col.7, line 3). 

Tajalli does not explicitly teach of a business component of an application 
program. 

Noguchi teaches of a business component of an application program (see Fig.1 
and col.4, lines 25-40). 

It would have been obvious to a person of ordinary skill in the art at the time the 
invention was made to modify the system of Tajalli in view of Noguchi to implement 
business component of an application program. One would be motivated to do so 
because Tajalli teaches that his system is generally related to reliably auditing computer 
usage in many organizations (see col.1, lines 16-20 & 24-27). 

As per claim 24, Tajalli teaches a method comprising: 
auditing an application program (see col. 15, lines 3-7: "collects and makes 
available to the administrator 126 information about the activities of application program 
514") wherein said auditing comprises creating an audit trail (see col.7, lines 1-3: 
"generates audit log"); 
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using the application program to perform audit trail functions (see col.6, Iines63- 
65: "Assured Audit (AA) system" and col. 15, lines 16-20: "audits activities of all 
application programs 514 and ordinary users 128") comprising: 

generating a list of components included in the application program (see col. 15, 
lines 3-7 & 17-18: "audits activities of all application programs" and col. 16, lines 16-24); 

presenting the list of components to a user (see col. 15, lines 3-7: "collects and 
makes available to the administrator 126 information about the activities of application 
program 514"); 

allowing the user to select a selected component to be audited (see col.6, line 
67-colT, line 1: "administrator specifies the nature of the audits"); 

presenting the list of operations that can be performed on the selected 
component to the user (see col. 15, lines 3-7: "collects and makes available to the 
administrator 126 information about the activities of application program 514"); and 

allowing the user to select one or more selected operations to be audited for the 
selected component (see col.6, line 67-col.7, line 1: "administrator specifies the nature 
of the audits"). 

Tajalli does not explicitly teach of a business component of an application 
program. 

Noguchi teaches of a business component of an application program (see Fig. 1 
and col.4, lines 25 : 40). 

It would have been obvious to a person of ordinary skill in the art at the time the 
invention was made to modify the system of Tajalli in view of Noguchi to implement 
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business component of an application program. One would be motivated to do so 
because Tajalli teaches that his system is generally related to reliably auditing computer 
usage in many organizations (see col.1 , lines 16-20 & 24-27). 

DEPENDENT: 

As per claim 2, which depend on claim 1 , Tajalli further teaches wherein the 
application program further comprises: means for detecting when the selected 
operations are performed (see col. 1 8, lines 45-50). 

As per claim 3, which depend on claim 2, Tajalli further teaches wherein the 
application program further comprises: means for generating an audit transaction record 
regarding the business component when the selected operations are detected (see 
col. 7, lines 1-3 and col. 16, lines 30-36). 

As per claim 4, 15, and 25, which depend on claims 1,14, and 24, respectively, 
Tajalli further teaches wherein the selected or list of operations to be audited include at 
least one of: update, add, copy, and delete (see col. 10, lines 7-13). 

As per claim 5, 16, and 26, which depend on claims 1,14, and 24, respectively, 
Tajalli teaches of further comprising means for allowing the user to restrict access to the 
audit trail by at least one of: an employee identifier, an employment position, and an 
area of responsibility (see col. 15, line 66 to col. 16, line 1). 

As per claim 6, 17, and 28, which depend on claims 3, 14, and 27, respectively, 
Tajalli teaches of further comprising means for storing the audit transaction record in an 
external database (see Fig. 1 and Fig. 3, #118). 
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As per claims 7, 18, and 29, which depend on claims 3, 14, and 27, respectively, 
Tajalli teaches of further comprising means for storing the audit transaction record in a 
file (see Fig. 1, #119). 

As per claims 8, 19, and 30, which depend on claims 7, 18, and 29, respectively, 
Tajalli teaches of further comprising means for importing the audit transaction record 
stored in the file to a database (see col. 16, lines 44-46). 

As per claims 9, 20, and 31, which depend on claims 3, 14, and 27, respectively, 
Tajalli further teaches wherein the audit transaction record includes at least one of: an 
identifier for the entity that accessed the business component or the field, the operation 
that was performed on the business component, when the operation was performed, a 
previous value of the field, a current value of the field, and how the value of at least a 
portion of the business component was changed (see col. 16, lines 16-24; "identity of 
any "objects" accessed"). 

As per claims 10, 21, and 32, which depend on claims 3, 14, and 27, 
respectively, Tajalli teaches of further comprising means for allowing the user to query 
one or more of the audit transaction records (implicit: see col. 17, lines 14-15). 

As per claims 12 and 34, which depend on claims 1 and 24, respectively, Tajalli 
and Noguchi further teaches wherein the one or more selected business components 
comprise one or more fields, and further comprising: means for selecting the one or 
more fields to be audited; and means for generating an audit transaction record when 
one of the selected operations on one of the selected fields is detected (see claim 14 
rejection above). 
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As per claim 27, which depend on claim 24, Tajalli teaches of further comprising: 
detecting when the selected operations are performed on one of the selected business 
components; and generating an audit transaction record when the selected operations 
are detected (see claim 2 and 3 rejections above). 

As per claim 36, which depend on claim 24, Tajalli and Noguchi further teach of 
a computer program product comprising: instructions for implementing the method of 
claim 24 (see Tajalli: col. 15, lines 48-52). 

As per claim 37, which depend on claim 24, Tajalli and Noguchi further teach of 
a data signal comprising: instructions for implementing the method of claim 24 (implicit: 
see Tajalli: col. 1 5, lines 48-52; col. 1 7, line 6). 

5. Claims 1 1, 23, and 33 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Tajalli et al. (US 5,361,359 A) and Noguchi et al. (US 5,812,981 A), 
further in view of Darnell et al. (US 5,596,700 A). 

As per claims 11, 23, and 33, which depend on claim 2, 14, and 27, 
respectively, Tajalli and Noguchi do not explicitly teach of further comprising means for 
prompting the user to enter a comment or a description of the operation when the 
selected operations are detected. 

Darnell teaches of prompting the user to enter a comment or a description of the 
operation when the selected operations are detected (see col. 3, lines 19-24 and col.11, 
lines 30-31). 
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It would have been obvious to a person of ordinary skill in the art at the time the 
invention was made to employ the teachings of within the system of Tajalli and Noguchi 
by implementing prompting the user to enter a comment or a description of the 
operation when the selected operations are detected within the apparatus of creating an 
audit trail for an application program because such an implementation provide 
numerous benefits similar to the functionality of writing notes on paper (see Darnell: 
col.1 , lines 42-44), notepads or sticky pads (i.e., for reminders or sharing information 
with others). 

6. Claims 13, 22, and 35 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Tajalli et al. (US 5,361 ,359 A) and Noguchi et al. (US 5,812,981 A), 
further in view of Smaha et al. (US 5,557,742 A). 

As per claims 13, 22 and 35, which depend on claims 1 , 14, and 34, 
respectively, Tajalli and Noguchi do not explicitly teach of further comprising means for 
allowing the user to restore the one or more of the fields to a previous state or value. 

Smaha teaches of allowing the user to restore the one or more of the fields to a 
previous state or value (see col.9, lines 49-55). 

It would have been obvious to a person of ordinary skill in the art at the time the 
invention was made to employ the teachings of Smaha within the system of Tajalli and 
Noguchi by implementing restoring the one or more of the fields to a previous state or 
value within the apparatus, system and method for creating an audit trail for an 
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application program in an information system because such functionality allows the 
system to go back to the state prior to a "misuse". 



Response to Arguments 

5. Applicant's arguments filed October 30, 2006 have been fully considered but they 
are not persuasive. 

Applicant(s) assert that neither references, Tajalli nor Noguchi, teach of a 
"business component" because the amended claim language states, "wherein a 
business component comprises one of a table or record comprising information 
associated with an entity". According to the specification "a business component 108 is 
a table, or record, of information for an item, person, or other entity..." (see 
specification, page 9, lines 27-28). Some examples are bank account information, sales 
opportunities or leads, and service representatives in customer service center (see 
specification, page 9, lines 30-34). In general a business component is some record, or 
table (i.e. data) pertaining to a business entity. Tajalli explicitly teaches this limitation. 

Tajalli teaches of auditing computer usage applicable in protecting inventory 
records of a business entity (see col.1 , lines 36-38). Tajalli further teaches that the 
system can be applied in all environments wherein security is a concern (see col.1, lines 
24-34). A data comprising a table or record is clearly subjective and not a novel feature 
of the invention. The applicant(s) are earnestly suggested to amend the claim language 
to incorporate inventive functional elements. 
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The applicant(s) argue that there is no support for combining Noguchi's business 
component to Tajalli's system because Tajalli's components are hardware and 
Noguchi's components are software. 

To better clarify the assertion, reference to col. 10, lines 30-34, cited in the 
previous office action has been removed and additional reference locations have been 
provided. Based on the clarification, both Tajalli and Noguchi teach of a software 
component. It is clear that the components of the application program are merely 
stored data that includes a record or table and such limit is explicitly taught throughout 
the cited reference. Furthermore, although it is clearly taught and suggested, one of 
ordinary skill in the art knows that any data or component is associated with a particular 
application program and needs that application program to render that data or perform 
some action to the data. 

Additionally, the applicant(s) argue that the examiner is combining two distinct 
embodiments because the examiner cites a feature in one embodiment and other 
features in another embodiment. 

In response, it is noted that reference to col.10, lines 30-34, cited in the previous 
office action has been removed and additional reference locations have been provided. 
Furthermore, Tajalli teaches that the embodiments are primary the same (see col. 15, 
lines 9-14) except wherein the AA system includes additional features (obvious 
improvement thereof). 

The applicant(s) argue that neither Tajalli nor Noguchi teaches "means for 
selecting a component to be audited". 
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This limitation is explicitly taught in col.6, line 67 to col.7, line 3. Tajalli teaches 
that the administrator specifies the audit configuration data, which in turn specifies the 
AA system to collect specific audit information. 

In response to applicant's argument that there is no suggestion to combine the 
references, the examiner recognizes that obviousness can only be established by 
combining or modifying the teachings of the prior art to produce the claimed invention 
where there is some teaching, suggestion, or motivation to do so found either in the 
references themselves or in the knowledge generally available to one of ordinary skill in 
the art. See In re Fine, 837 F.2d 1071 , 5 USPQ2d 1596 (Fed. Cir. 1988) and In re 
Jones, 958 F.2d 347, 21 USPQ2d 1941 (Fed. Cir. 1992). In this case, Tajalli clearly 
teaches that the system overcomes the prior art in a business or government agency 
environment. 

During patent examination, the pending claims must be given their broadest 
reasonable interpretation consistent with the specification. See In re Hyatt, 21 1 F.3d 
1367, 1372, 54 USPQ2d 1664, 1667 (Fed. Cir. 2000). Furthermore, while the claims of 
issued patents are interpreted in light of the specification, prosecution history, prior art 
and other claims, this is not the mode of claim interpretation to be applied during 
examination. During examination, the claims must be interpreted as broadly as their 
terms reasonably allow. See In re American Academy of Science Tech Center, F.3d 
2004 WL 1067528 (Fed. Cir. May 13, 2004). 

Applicant(s) are earnestly suggested to particularly point out and distinctly claim 
the subject matter that the applicant(s) regard as the invention to expedite prosecution. 



Application/Control Number: 09/963,292 
Art Unit: 2155 



Page 14 



Conclusion 

6. For the reason above claims 1-37 have been rejected and remain pending. 

7. Applicant's amendment necessitated the new ground(s) of rejection presented in 
this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP 

§ 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 
CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the date of this final action. 

8. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Michael Y. Won whose telephone number is 571-272- 
3993. The examiner can normally be reached on M-Th: 7AM-5PM. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Saleh Najjar can be reached on 571-272-4006. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 





December 15, 2006 



